The vulnerability occurs in the Linux kernel’s Bluetooth hci_sync module where a pointer to an advertising instance is returned only while the device lock is held. Subsequent code paths release that lock before waiting for controller responses, yet still hold and write to the freed pointer, triggering a use‑after‑free that corrupts kernel memory and can cause a crash or denial of service. The flaw is a classic use‑after‑free (CWE‑825) that can potentially be leveraged for privilege escalation if an attacker can force the kernel to execute arbitrary code in memory.

All Linux kernel builds that include the Bluetooth hci_sync code are affected; no specific version is listed, so any kernel with Bluetooth support is considered at risk until the patch in the referenced commits is applied.

With a CVSS score of 8.8 the problem is high‑severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The relevant attack vector is inferred from the description: an attacker would need to send crafted Bluetooth advertising or termination packets that trigger the vulnerable path. The vulnerability is not currently listed in the CISA KEV catalog, but successful exploitation could lead to kernel panic or privilege escalation, presenting a moderate to high risk for systems with Bluetooth enabled.